PT-2020-10395 · Trend Micro · Trend Micro Anti-Threat Toolkit

Stefan Kanthak · Published 2020-01-30 · Updated 2021-07-21 · CVE-2019-20358

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below

Description The issue may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed. An attack vector similar to a previously identified vulnerability was discovered and resolved in a later version of the tool.

Recommendations For versions 1.62.0.1218 and below, update to version 1.62.0.1228 or later to resolve the issue.

Fix

RCE

Incorrect Permission

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-732

CWE-427

CWE-426

Related Identifiers

CVE-2019-20358

Affected Products

Trend Micro Anti-Threat Toolkit

References · 7

• https://osv.dev/vulnerability/CVE-2019-20358 · Vendor Advisory
• https://success.trendmicro.com/solution/000149878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20358 · Security Note
• https://t.me/defcon_news/37202 · Telegram Post
• https://t.me/cvenotify/684 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Jan/50 · Note
• https://seclists.org/bugtraq/2020/Jan/55 · Note